GNU bug report logs - #76129
[PATCH] gnu: mullvadbrowser: Update to 14.0.5 [security fixes].

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 76129 in the body.
You can then email your comments to 76129 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: André Batista <nandre <at> riseup.net>
To: guix-patches <at> gnu.org
Cc: André Batista <nandre <at> riseup.net>
Subject: [PATCH] gnu: mullvadbrowser: Update to 14.0.5 [security fixes].
Date: Fri,  7 Feb 2025 17:27:25 -0300

Fixes CVEs 2024-11704, 2025-1009, 2025-1010, 2025-1011, 2025-1012,
2025-1013, 2025-1014, 2025-1016 and 2025-1017.  See
<https://www.mozilla.org/en-US/security/advisories/mfsa2025-09/> for
details.

* gnu/packages/tor-browsers.scm (%mullvadbrowser-build-date): Update to
20250203100000.
(%mullvadbrowser-version): Update to 14.0.5.
(%mullvadbrowser-firefox-version): Update to 128.7.0esr-14.0-1-build2.
(mullvadbrowser-translation-base): Update to
93eddbd3888852c09e130d536fb3c9bd7e4e6f57.

Change-Id: I3932142356fd3e44d9a3220953df8ae236b90537
---
 gnu/packages/tor-browsers.scm | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/gnu/packages/tor-browsers.scm b/gnu/packages/tor-browsers.scm
index 361acc7738..2718622f79 100644
--- a/gnu/packages/tor-browsers.scm
+++ b/gnu/packages/tor-browsers.scm
@@ -818,17 +818,17 @@ (define %mullvadbrowser-locales (list "ar" "da" "de" "es-ES" "fa" "fi" "fr" "it"
 
 ;; We copy the official build id, which can be found there:
 ;; https://cdn.mullvad.net/browser/update_responses/update_1/release.
-(define %mullvadbrowser-build-date "20250106125732")
+(define %mullvadbrowser-build-date "20250203100000")
 
 ;; To find the last version, look at
 ;; https://mullvad.net/en/download/browser/linux.
-(define %mullvadbrowser-version "14.0.4")
+(define %mullvadbrowser-version "14.0.5")
 
 ;; To find the last Firefox version, browse
 ;; https://archive.torproject.org/tor-package-archive/mullvadbrowser/<%mullvadbrowser-version>
 ;; There should be only one archive that starts with
 ;; "src-firefox-mullvad-browser-".
-(define %mullvadbrowser-firefox-version "128.6.0esr-14.0-1-build1")
+(define %mullvadbrowser-firefox-version "128.7.0esr-14.0-1-build2")
 
 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-base
@@ -836,11 +836,11 @@ (define mullvadbrowser-translation-base
     (method git-fetch)
     (uri (git-reference
           (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "bb1df34ec79d55dcd1e0ebc80cb2c72d27c462b7")))
+          (commit "93eddbd3888852c09e130d536fb3c9bd7e4e6f57")))
     (file-name "translation-base-browser")
     (sha256
      (base32
-      "0mhfbmghvdd1rpvpr8ppkdpzwwb9v03a211qgi27j3iwaa04zh9m"))))
+      "1s0lys5kzdgd1vk8la4vd5kkfpb5kvaf2rhd0vgzq4fva7gflm94"))))
 
 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-specific
@@ -868,7 +868,7 @@ (define mullvadbrowser-assets
          version "/mullvad-browser-linux-x86_64-" version ".tar.xz"))
        (sha256
         (base32
-         "0cycrxil9zbdqrkzzsfx7nlrhs4k5riwi0y7r0ah2snmpcla4nb3"))))
+         "0l544hl9kbashcx9qrih1qf1zz2cdny733ry1r1v13g85760ipyb"))))
     (arguments
      (list
       #:install-plan
@@ -911,7 +911,7 @@ (define-public mullvadbrowser
          %mullvadbrowser-firefox-version ".tar.xz"))
        (sha256
         (base32
-         "0x5q0g62ndy9r7qqrz0p35bq258sn26bdwhzs396v8mrzyf4jywh"))))
+         "04val15xsfl118d18xpnhhy5cshlgkdpp58y0ja306glx453kcpl"))))
     (arguments
      (substitute-keyword-arguments (package-arguments mullvadbrowser-base)
        ((#:phases phases)

base-commit: 70231fe7757f839f6ddd58d3c8a522b2e56fefe5
-- 
2.46.0

Message #10 received at 76129 <at> debbugs.gnu.org (full text, mbox):

From: André Batista <nandre <at> riseup.net>
To: Ian Eure <ian <at> retrospec.tv>
Cc: 76129 <at> debbugs.gnu.org
Subject: Was [bug#76129], mullvadbrowser: glean, psutil and zstd [security
 fixes].
Date: Thu, 20 Feb 2025 17:39:03 -0300

Hi Ian,

ter 11 fev 2025 às 06:57:41 (1739267861), ian <at> retrospec.tv enviou:
> Hi André,
> 
> The patch looks good; I’m building it now to make sure it passes and seems
> to work, and will push today assuming it does.
> 
> I noticed that some python dependencies seem to be missing from
> native-inputs, which cause the build to attempt downloading them, printing
> messages like:
> 
>    WARNING: Retrying (Retry(total=4, connect=None, read=None,
> redirect=None, status=None)) after connection broken by
> 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection
> object at 0x7ffff56cb520>: Failed to establish a new    connection: [Errno
> -3] Temporary failure in name    resolution')': /simple/glean-sdk/
> 
> It looks like glean-sdk (seems to be unpackaged in Guix), python-psutil, and
> python-zstandard are the missing packages triggering this.  This doesn’t
> fail the build, so it seems these aren’t critical.  If you’re willing to
> either add the deps, remove them from wherever they’re listed, or otherwise
> stop the download attempts (which take a while to retry and fail), I think
> that’d be a good followup.
> 

I've checked the build logs and after those warning messages we get:

-------
(...)
Could not install glean-sdk, so telemetry will not be collected. Continuing.
Could not install psutil, so telemetry will be missing some data. Continuing.
Could not install zstandard, so zstd archives will not be possible to extract.
Continuing.
Configure complete!
(...)
-------

However, upstream purposefully disables telemetry by unsetting the
variable 'MOZ_TELEMETRY_REPORTING' and that's sensible IMO.  So glean-sdk
and psutil have no place on our build.  OTOH, zstandard is used to
extract blobs (included/downloaded?) which is also foreign to our goals
on guix and a possible threat vector (remember xz-utils?).

So I don't think any of them should be included.  As for mozilla's
warnings, I can live with them.  It seems to me that patching the sources
to remove those checks/messages would be much trouble for little gain: a
couple of seconds at best?

Can you live with them as well?

Cheers!

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.